Field of the Invention
Embodiments of the present invention relate to authenticating e-mail messages.
Related Art
One major concern in the field of electronic commerce is the need to identify and verify communications between parties. For example, when a customer is engaged in an e-commerce transaction with their bank, it is important to both the customer and the bank that the customer be able to identify and trust e-mail received from the bank. This concern is further complicated by third-party transactions, where a third party sends a message on behalf of someone else, such as where an online payment entity sends an e-mail to a customer on behalf of a seller.
A number of technologies, such as SPF (sender policy framework; RFC 4408) and Sender ID (RFC 4406), have been developed to help verify e-mail exchanged between servers or MTAs (mail transfer agents). Generally, these technologies are used to help ensure that the identifying information included in an e-mail's headers correlates with the sending MTA. However, these technologies do not address the problem of legitimate yet fraudulent senders; for example, an e-mail sent from Your0nlineBank.com (with the number “0”) may comply with all of the necessary standards, but a user receiving that e-mail may easily confuse it for a legitimate e-mail from YourOnlineBank.com (with the letter “O”).
The existing standards are set up to help prevent e-mail with forged header information from reaching the end user. However, the current standards do not protect the user from fraudulent e-mail with correct, but misleading, header information. Further, the current standards do not provide the user with any indicator of an e-mail which is authentic and trustworthy, as the current standards do not test for authenticity or trustworthiness.